Managing User Roles - NodeJS Authorization

Best Tech Resume Template: papermoontech....
Use code: PEDRO for 20% off ^
In this video I will teach you guys how to create an api with a role based authorization system.
-
🚀 Learn ReactJS By Building 6 Projects: codedamn.com/l...
💻 PedroTech Discord: / discord
-
Social
▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬
Website: machadopedro.com
Twitter: / pedrotech_
Linkedin: / machadop1407
Instagram: / _pedro.machado_
Github: github.com/mac...
Email: [e-mail]
Equipments I Use:
▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬
🌟 Algorithm Book To Pass Coding Interviews: amzn.to/2Z2CirS
🌟 Microphone: amzn.to/2MKAm4V
🌟 Keyboard: amzn.to/3d0QauN
🌟 HD Webcam: amzn.to/3tMpJPD
🌟 Room LED Lights: amzn.to/3a5mFGp
Tags:
- NodeJS
- User Roles
- ReactJS Tutorial
- ReactJS and MySQL
- NodeJS Tutorial
- API Tutorial

[@chibuzoekwue]

I never new middle ware functions could take arguments. I quess we learn everyday. Thanks 👍

[@PedroTechnologies]

I found out about this a couple months ago hahaha was surprised too!

[@awekeningbro1207]

actually, that function is not a middleware but, is returning a middleware upon calling in the app.get

[@vision6D]

Appreciated your presentation and specially the remark at the end where you make us aware of this being an example to understand the mechanism, but that it should never be implemented that way. Authentication has to be made first and tokens have to be delivered. Roles should not be passed between client and server, nor username, nor userid. Based on the token the server side retrieves the userid and associated roles for the app and then performs the authorization. Greeting from Geneva.

[@abhishekrawat8579]

i've downloaded it and will watch it when my exams gets over.❤️❤️❤️❤️

[@PedroTechnologies]

Hahaha thank you for the support! Im going through exams too! Good luck!

[@mikealejandro3938]

First comment ! I'm currently learning backend, i want to become a MERN developer, fullstack developer whatever, and i'm still undertanding how the backend works and videos like this one cna help me too much ! Thank you homie

[@PedroTechnologies]

Thank youu! Glad I am able to help! If I could give an advice for you that is starting to learn backend, I would advice you not to skip the fundamentals. For example, understand how an api works and the different aspects of a http request. Best of luck!

[@mikealejandro3938]

@@PedroTechnologies Thanks My Man

[@ayoubnachat5920]

Hi pedro i like your tutorials a lot *So can you please do another one about managing users rolls but in this with JWT and more secure also with an interface like using Ejs instead of PostMan* and i will be so thankful if you do it 💜😁

[@pegihr]

This is what I’ve been waiting for. Thank You

[@PedroTechnologies]

Happy to help! I am glad you liked the video!

[@joseisraeldiazzapata5179]

ooohh, thank you Pedro. This is useful and fun to manage different sutf with the api rest

[@PedroTechnologies]

Thank you! Glad you liked the video!

[@sacibrancooficial]

Pedro lançou a braba mesmo! Congrats my friend!

[@tarekghosn3648]

thank you. there is a way in how you connect things. sometimes noobs like me get over whelmed when we see an error.

[@abhishekprasad6317]

Very underrated video. Much Love ❤️

[@PedroTechnologies]

Thank you!! 😊

[@paulikhane]

I am your 100,00oth subscriber!!!! Let me know when you get the plague. Congratulations.

[@somel_toi309]

I love this guy, makes everything I need to know easier to understand

[@ejazmuneeb]

you should be #1 on top for web dev videos.

[@zulfikarahmad3684]

Thank you bro... I want to ask, can we use social media authentication like google/fb for REST API? I don't know how to implement it to rest api

[@PedroTechnologies]

You can definitely use it, however you still need to save the user somewhere and find a way to maintain them authenticated for a long time. Many companies prefer it this way in order for them not to keep track of passwords!

[@im_parth]

Never knew middlewares could take up arguments! Also had a qn that we should not decide the role based on the body field right because it's easy to intercept the request and change the field via proxies like burpsuite . Correct me if I am wrong. Great video :)

[@nobytes2]

The role should be given upon sign up, or some subscription. In real world you'll never send role with the body.

[@liyucollections9046]

It great video Pedro.... can u tell us more on How to set up specific secured password and username which solely authorized manage admin page....like the one asked to login into our own pc.

[@shafayet_hossain]

Best coding channel

[@PedroTechnologies]

Hahaha thank you so much for the support!

[@jeff-creations]

Excellent video Pedro. I'm using vs code and Hoppscotch. Do you have any idea why I needed to change my GET requests to POST requests to get the code to work? Really weird, I followed the tutorial to the "T". Regardless, the code works and am able to crudely authenticate.

[@thiagovilla970]

BR representando :)

[@usmanmughal5916]

Hey Pedro! Can you add login with Facebook or with Google in your type-graphql series, I am really having a hard time figuring out how to do log in with Google in my project which is based on type-graphql and frontend is on nextjs.

[@PedroTechnologies]

Hey, it depends on what you are trying to do! Are you using firebase for authentication? Are you using the google and facebook api? I planned on adding a video on a manual auth system.

[@usmanmughal5916]

@@PedroTechnologies no firebase just normal session authentication with cookies and just want to add google login or facebook.

[@constWardtz]

Thank you buddy!

[@PedroTechnologies]

Any time!

[@robinsonzapata1]

great tutorial! thank you so much!

[@itsnobledean9450]

I been looking for this kind of simple clarity. No pompous nonsense. Just pertinent information.

[@onkelhoy1]

But what if I change the role in the body that’s passed? This is a very bad security

[@viktorsvoboda3186]

cool video thx. dont u have pls the code posted for this somewhere?

[@abhishekkumaryadav652]

Hey pedro, could you tell me how can i add body in request in postman, like we can't pass a body in get request how you are doing it, when i was trying to do it, i am getting error like cannot read properties of undefined 'role'.12:20

[@thiagosaurotv140]

Thanks a lot for this, bro! Class 420, present

[@josearmandozeballosduran7086]

Amazing explication.

[@mouctechy]

Thanks Pedro

[@simonIsDev]

It's so very understand, thanks for this perfect video

[@thrifterspoint1002]

thank u so much concept clear

[@MrRossss1]

Great stuff. Thanks

[@liyucollections9046]

It's gr8 video as always....but i was trying to make admin with sepecific,secured password for my web pro.if u can plz help me on this.just tell me the way.thank u!

[@caetanog_]

Great video !

[@becbelk]

in min 10 you use currying.... so it is FP style... thats cool

[@softwareandnetworkingtechn5946]

Thank you Pedro how to become a mern developer it is not easy to me to master it

[@cinegolpo-movieexplainedin8192]

when user role updated how to manage jwt?

[@002ashishkumar5]

I start your videos with a like

[@pedrocosta9769]

Top. Cadê o código Pedrão?

[@mani_naik]

"pedro who obviously got a 100 " ...lol ...liked the video for this humourXD

[@PedroTechnologies]

Lmaoo gotta stay humble

[@On7D7]

lol.. i got 100 on Software Requirement Engineering course

[@ritugupta4385]

Hey, I just found your channel and it has impressive contents...Would you please help me with implementing guest mode feature for my website ?

[@lei800123]

Love the explanation on each little element of the code. This helped a lot for a beginner like me. Keep it up! Thank you for the great work!

[@Grishopping]

Thanks friend.... will you plan to make another video with more advanced techniques as you comment on the video? My English is bad. I use a translator... I greet you from Venezuela. I already subscribed and gave him a thumbs up... My name is Jose Grillo ESPAÑOL Gracias amigo.... tendras pensado sacar otro video con tecnicas mas avanzadas como comentas en el video? mi ingles es malo uso traductor... te saludo de Venezuela Ya me suscribi y le di manito arriba... Mi nombre es Jose Grillo

[@蹦太君-o4d]

great

[@reubenmoses1363]

athorization goood

[@spreadItWide]

leo needs a tutor

[@djkeiran2172]

can we have source code

[@nomchomppom]

hi, just wondering but should it be more safe to have a table on the backend database which contains users' roles/courses enrolled instead of validating against the body of the client that anyone can modify?

[@im_parth]

I also commented the same thing LOL :)

[@thiagovilla970]

Actually, what you'd do in a more realistic (production-ready) approach is to have the user role(s) set in her profile in the DB by an admin or the like. Then, when the server spawns a session (stateful-) or issues a JWT (stateless authentication), that or those roles are attached to the session or written inside the JWT. In the latter case, the token can't be messed with (e.g. up the user roles) cause that'll break the encryption and hence invalidate the token. Pedro's example is didactic and beginner-friendly, but it's a big _no no_ as you guys spotted yourselves.

[@arthurcorona]

Bom inglês.

[@wilmerfroilan8991]

code source ?